Computer Sciences Commons^™

Rootkit Detection Using A Cross-View Clean Boot Method, Bridget N. Flatley

Theses and Dissertations

In cyberspace, attackers commonly infect computer systems with malware to gain capabilities such as remote access, keylogging, and stealth. Many malware samples include rootkit functionality to hide attacker activities on the target system. After detection, users can remove the rootkit and associated malware from the system with commercial tools. This research describes, implements, and evaluates a clean boot method using two partitions to detect rootkits on a system. One partition is potentially infected with a rootkit while the other is clean. The method obtains directory listings of the potentially infected operating system from each partition and compares the lists to …

Mobile Network Defense Interface For Cyber Defense And Situational Awareness, James C. Hannan

Theses and Dissertations

Today's computer networks are under constant attack. In order to deal with this constant threat, network administrators rely on intrusion detection and prevention services (IDS) (IPS). Most IDS and IPS implement static rule sets to automatically alert administrators and resolve intrusions. Network administrators face a difficult challenge, identifying attacks against a vast number of benign network transactions. Also after a threat is identified making even the smallest policy change to the security software potentially has far-reaching and unanticipated consequences. Finally, because the administrator is primarily responding to alerts they may lose situational awareness of the network. During this research a …

Accountable Authority Identity-Based Encryption With Public Traceability, Junzuo Lai, Robert H. Deng, Yunlei Zhao, Jian Weng

Research Collection School Of Computing and Information Systems

At Crypto’07, Goyal introduced the notion of accountable authority identity-based encryption (A-IBE) in order to mitigate the inherent key escrow problem in identity-based encryption, and proposed two concrete constructions. In an A-IBE system, if the private key generator (PKG) distributes a decryption key or produces an unauthorized decryption box for a user maliciously, it runs the risk of being caught and sued in the court of law with the help of a tracing algorithm. Subsequent efforts focused on constructions of A-IBE schemes with enhanced security. In these A-IBE constructions, the tracing algorithm needs to take a user’s decryption key as …

Almost Touching: Parent-Child Remote Communication Using The Sharetable System, Svetlana Yarosh, Anthony Tang, Sanika Mokashi, Gregory D. Abowd

Research Collection School Of Computing and Information Systems

We deployed the ShareTable - a system that provides easy-to-initiate videochat and a shared tabletop task space - in four divorced households. Throughout the month of its use, the families employed the ShareTable to participate in shared activities, share emotional moments, and communicate closeness through metaphorical touch. The ShareTable provided a number of advantages over the phone and was easier to use than standard videoconferencing. However, it did also introduce concerns over privacy and new sources of conflict about appropriate calling practices. We relate our findings to the larger research landscape and present implications for future work.

Simple Identity-Based Encryption With Mediated Rsa, Xuhua Ding, Gene Tsudik

Research Collection School Of Computing and Information Systems

Identity-based encryption (IBE) [5] and digital signatures are important tools in modern secure communication. In general, identity-based cryptographic methods facilitate easy introduction of public key cryptography by allowing an entity’s public key to be derived from some arbitrary identification value such as an email address or a phone number. Identity-based cryptography greatly reduces the need for, and reliance on, public key certificates. Mediated RSA (mRSA) [4] is a simple and practical method of splitting RSA private keys between the user and the Security Mediator (SEM). Neither the user nor the SEM can cheat one another since each signature or decryption …

Comparing Mobile Privacy Protection Through Cross-Platform Applications, Jin Han, Qiang Yan, Debin Gao, Jianying Zhou, Robert H. Deng

Research Collection School Of Computing and Information Systems

With the rapid growth of the mobile market, security of mobile platforms is receiving increasing attention from both research community as well as the public. In this paper, we make the first attempt to establish a baseline for security comparison between the two most popular mobile platforms. We investigate applications that run on both Android and iOS and examine the difference in the usage of their security sensitive APIs (SS-APIs). Our analysis over 2,600 applications shows that iOS applications consistently access more SS-APIs than their counterparts on Android. The additional privileges gained on iOS are often associated with accessing private …

I Can Be You: Questioning The Use Of Keystroke Dynamics As Biometrics, Chee Meng Tey, Payas Gupta, Debin Gao

Research Collection School Of Computing and Information Systems

Keystroke dynamics refer to information about the typing patterns of individuals, such as the relative timing when the individual presses and releases each key. Prior studies suggest that such patterns are unique and cannot be easily imitated. This lays the foundation for the use of keystroke biometrics in authentication systems. The research effort in this area has thus far focused on novel detection techniques to differentiate between legitimate users and imposters. In this paper, we demonstrate a novel feedback and training interface named Mimesis. Mimesis provides both positive and negative feedback on the differences between a submitted pattern vs. a …

Raising The Game: Applying Theory And Analytics To Real-World Threats, Singapore Management University

Perspectives@SMU

Safety and security are, on many levels, essential priorities for governments, businesses and individuals. While an increase of defence and security budgets may bring some assurance of peaceful times to come, it seems the world has no lack of insane perpetrators who can still somehow evade, breach, ambush, assail and attack as they please. Enter the “Bayesian Stackelberg Game”, a game theory model that can, and has been applied rather successfully to the allocation of security resources in the United States by Prof Milind Tambe, University of Southern California.

Developing Focused Auditing Tools: A Practical Framework For Creating Formalized Multi-Level Security Policy Specifications, Barbara Ann Brough

Theses Digitization Project

The purpose of this study is that formalized policy specifications and focused penetration testing are needed to effectively audit any information system. Designing and maintaining the security system information is the primary duty of the cyber security professional. In today's world, nearly all government agencies manage some form of financial, defense, national security, and/or privacy information security policies. It is also necessary in this environment that agencies are accountable for auditing the security systems that protect this information.

The Implementation Of A Thin Client In The Department Of Defense Network System, Sung Ju In

Theses Digitization Project

The purpose of this project is to introduce and analyze a thin client solution that could enhance the overall Department of Defense (DoD) network system as well as its IT security posture, minimize risk from external threats, and ease of network operations.

Quantum Cryptography, Razvan Augustin Dinu

Theses Digitization Project

This study builds a case for using a quantum computer for solving cryptographic problems. It looks at the quantum turing machine concept, explores why use quantum computers and presents Deutsch's problem which allows one to select from amongst the parallel paths a quantum computer calculates.

Security Risks And Protection In Online Learning: A Survey, Yong Chen, Wu He

Distance Learning Faculty & Staff Publications

This paper describes a survey of online learning which attempts to determine online learning providers' awareness of potential security risks and the protection measures that will diminish them. The authors use a combination of two methods: blog mining and a traditional literature search. The findings indicate that, while scholars have identified diverse security risks and have proposed solutions to mitigate the security threats in online learning, bloggers have not discussed security in online learning with great frequency. The differences shown in the survey results generated by the two different methods confirm that online learning providers and practitioners have not considered …

Use Of General Purpose Graphical Processing Units In Blowfish Encryption Algorithm, Cankat Duman

Theses Digitization Project

The purpose of this project is to present the findings of the work that has been completed on exploring the possibilities of speedup gained when using General Purpose Graphical Processing Units for the Blowfish encryption algorithm with the use of the CUDA (Computer Unified Device Architecture) programming language and architecture.

College Student Home Computer Security Adoption, Chet L. Claar, Robert C. Shields, David Rawlinson, Robert Lupton

All Faculty Scholarship for the College of the Sciences

The home Internet user faces a hostile environment abundant in potential attacks on their computers. These attacks have been increasing at an alarming rate and cause damage to individuals and organizations regularly, and have the potential to cripple the critical infrastructures of entire countries. Recent research has determined that some individuals are not utilizing additional software protections available to mitigate these potential security risks. This paper seeks to clarify the reasons by proposing a conceptual framework that utilizes the Health Belief Model as a possible way to explain why some people do not perceive a threat sufficient to prompt the …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

A Simple Experiment With Microsoft Office 2010 And Windows 7 Utilizing Digital Forensic Methodology, Gregory H. Carlton

Journal of Digital Forensics, Security and Law

Digital forensic examiners are tasked with retrieving data from digital storage devices, and frequently these examiners are expected to explain the circumstances that led to the data being in its current state. Through written reports or verbal, expert testimony delivered in court, digital forensic examiners are expected to describe whether data have been altered, and if so, then to what extent have data been altered. Addressing these expectations results from opinions digital forensic examiners reach concerning their understanding of electronic storage and retrieval methods. The credibility of these opinions evolves from the scientific basis from which they are drawn using …

The Advanced Data Acquisition Model (Adam): A Process Model For Digital Forensic Practice, Richard Adams, Val Hobbs, Graham Mann

Journal of Digital Forensics, Security and Law

As with other types of evidence, the courts make no presumption that digital evidence is reliable without some evidence of empirical testing in relation to the theories and techniques associated with its production. The issue of reliability means that courts pay close attention to the manner in which electronic evidence has been obtained and in particular the process in which the data is captured and stored. Previous process models have tended to focus on one particular area of digital forensic practice, such as law enforcement, and have not incorporated a formal description. We contend that this approach has prevented the …

Prism And Privacy: Will This Change Everything?, Fred H. Cate, Christopher Kuner, Christopher Millard, Dan Jerker B. Svantesson

Articles by Maurer Faculty

No abstract provided.

Information Management Compliance: Frameworks For Governance & Assurance, Thomas B. Malvey

Senior Seminars

No abstract provided.

The Internet And How The Government Has Impacted Its Usage Today, Jonathan Hulse

Senior Seminars

No abstract provided.

Notice And Consent In A World Of Big Data, Fred H. Cate, Viktor Mayer-Schönberger

Articles by Maurer Faculty

• Nowadays individuals are often presented with long and complex privacy notices routinely written by lawyers for lawyers, and are then requested to either ‘consent’ or abandon the use of the desired service.
• The over-use of notice and consent presents increasing challenges in an age of ‘Big Data’.
• These phenomena are receiving attention particularly in the context of the current review of the OECD Privacy Guidelines.
• In 2012 Microsoft sponsored an initiative designed to engage leading regulators, industry executives, public interest advocates, and academic experts in frank discussions about the role of individual control and notice and consent in data protection …

Information Security Challenge Of Qr Codes, Nik Thompson, Kevin Lee

Journal of Digital Forensics, Security and Law

The discipline of information security must adapt to new technologies and methods of interaction with those technologies. New technologies present both challenges and opportunities for the security professional, especially for areas such as digital forensics. Challenges can be in the form of new devices such as smartphones or new methods of sharing information, such as social networks. One such rapidly emerging interaction technology is the use of Quick Response (QR) codes. These offer a physical mechanism for quick access to Web sites for advertising and social interaction. This paper argues that the common implementation of QR codes potentially presents security …

Measuring Inconsistency Methods For Evidentiary Value, Fred Cohen

Journal of Digital Forensics, Security and Law

Many inconsistency analysis methods may be used to detect altered records or statements. But for admission as evidence, the reliability of the method has to be determined and measured. For example, in China, for evidence to be admitted, it has to have 95% certainty of being correct,1 and that certainty must be shown to the court, while in the US, evidence is admitted if it is more probative than prejudicial (a >50% standard).2 In either case, it is necessary to provide a measurement of some sort in order to pass muster under challenges from the other side. And in most …

Technology Corner Visualising Forensic Data: Evidence (Part 1), Damian Schofield, Ken Fowle

Journal of Digital Forensics, Security and Law

Visualisation is becoming increasingly important for understanding information, such as investigative data (for example: computing, medical and crime scene evidence) and analysis (for example: network capability assessment, data file reconstruction and planning scenarios). Investigative data visualisation is used to reconstruct a scene or item and is used to assist the viewer (who may well be a member of the general public with little or no understanding of the subject matter) to understand what is being presented. Analysis visualisations, on the other hand, are usually developed to review data, information and assess competing scenario hypotheses for those who usually have an …

How Often Is Employee Anger An Insider Risk I? Detecting And Measuring Negative Sentiment Versus Insider Risk In Digital Communications, Eric Shaw, Maria Payri, Michael Cohn, Ilene R. Shaw

Journal of Digital Forensics, Security and Law

This research introduced two new scales for the identification and measurement of negative sentiment and insider risk in communications in order to examine the unexplored relationship between these two constructs. The inter-rater reliability and criterion validity of the Scale of Negativity in Texts (SNIT) and the Scale of Insider Risk in Digital Communications (SIRDC) were established with a random sample of email from the Enron archive and criterion measures from established insiders, disgruntled employees, suicidal, depressed, angry, anxious, and other sampled groups. In addition, the sensitivity of the scales to changes over time as the risk of digital attack increased …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Technology Corner: Visualising Forensic Data: Evidence Guidelines (Part 2), Damian Schofield, Ken Fowle

Journal of Digital Forensics, Security and Law

Visualisation is becoming increasingly important for understanding information, such as investigative data (for example: computing, medical and crime scene evidence) and analysis (for example, network capability assessment, data file reconstruction and planning scenarios). Investigative data visualisation is used to reconstruct a scene or item and is used to assist the viewer (who may well be a member of the general public with little or no understanding of the subject matter) to understand what is being presented. Analysis visualisations, on the other hand, are usually developed to review data, information and assess competing scenario hypotheses for those who usually have an …

How Often Is Employee Anger An Insider Risk Ii? Detecting And Measuring Negative Sentiment Versus Insider Risk In Digital Communications–Comparison Between Human Raters And Psycholinguistic Software, Eric Shaw, Maria Payri, Michael Cohn, Ilene R. Shaw

Journal of Digital Forensics, Security and Law

This research uses two recently introduced observer rating scales, (Shaw et al., 2013) for the identification and measurement of negative sentiment (the Scale for Negativity in Text or SNIT) and insider risk (Scale of Indicators of Risk in Digital Communication or SIRDC) in communications to test the performance of psycholinguistic software designed to detect indicators of these risk factors. The psycholinguistic software program, WarmTouch (WT), previously used for investigations, appeared to be an effective means for locating communications scored High or Medium in negative sentiment by the SNIT or High in insider risk by the SIRDC within a randomly selected …

Trends In Android Malware Detection, Kaveh Shaerpour, Ali Dehghantanha, Ramlan Mahmod

Journal of Digital Forensics, Security and Law

This paper analyzes different Android malware detection techniques from several research papers, some of these techniques are novel while others bring a new perspective to the research work done in the past. The techniques are of various kinds ranging from detection using host based frameworks and static analysis of executable to feature extraction and behavioral patterns. Each paper is reviewed extensively and the core features of each technique are highlighted and contrasted with the others. The challenges faced during the development of such techniques are also discussed along with the future prospects for Android malware detection. The findings of the …

Risk Management Of Email And Internet Use In The Workplace, John Ruhnka, Windham E. Loopesko

Journal of Digital Forensics, Security and Law

The article surveys the changing risk environment for corporations from their employees’ electronic communications. It identifies the types of liabilities that corporations can incur from such employee communications. It discusses the objectives of corporate internet use policies and the types of provisions such policies should contain. It suggests an alternative risk-based approach to corporate acceptable use policies instead of a traditional “laundry list” of internet use prohibitions.